CVE-2026-8461: ffmpeg Out-of-bounds Write
CVSS: 8.8v3.1HighAwaiting analysis
AliasesMGASA-2026-0249SUSE-SU-2026:3632-1UBUNTU-CVE-2026-8461DEBIAN-CVE-2026-8461CGA-34p8-hgg7-fcm8CGA-3638-357x-grm6CGA-6qfg-gjhc-xm7cCGA-94fm-55g8-2x58CGA-9636-mpx8-w6mrCGA-cccq-rmm2-fw66CGA-gqxg-jjc3-vx95CGA-mc37-5gvg-ppx2openSUSE-SU-2026:11384-1CGA-2qrv-rr58-x98xCGA-2vv4-pp22-h94hCGA-3mfv-9hgv-7j2hCGA-497h-m87j-fvrpCGA-5fqp-9f9c-6wfwCGA-6f2p-g6v5-hr9xCGA-7cpf-mr2h-cwxcCGA-c3f7-5v5v-g3xvCGA-f8x5-hqcg-mhrmCGA-g788-qxpm-vph4CGA-g8j5-23hr-7wp5CGA-j34c-92fc-vjcqCGA-jqch-6mvg-p637CGA-m2vq-vx43-859rCGA-m5v7-89h7-4qxfCGA-mpqw-xh5f-85mqCGA-q6qh-q7mg-75wrCGA-qpj9-q3rj-75g4CGA-r4m4-grqx-5888CGA-wccr-qjmh-jwpmCGA-x5p4-cxqx-23jjCGA-xf5w-96r9-6mx8
Published 18-06-2026Last modified 23-07-2026
Vulnerability summary
CVE-2026-8461 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in ffmpeg. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.2% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
1.03%
0%100%
Low · -0.54 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 18-06-2026PublishedVulnerability first disclosed.
- 23-07-2026Last modifiedVulnerability information updated.
Description
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
-0.54 pp
From 1.57% on 19-09-2026
19-09-202619-10-2026
EPSS score1.03%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- eco-python-ffmpeg-6-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-devAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-staticAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
Suse13 products
- ffmpeg&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.4.2-150200.11.76.1
- ffmpeg&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.4.2-150200.11.76.1
- ffmpeg&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 3.4.2-150200.11.76.1
- ffmpeg&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 3.4.2-150200.11.76.1
- ffmpeg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7< 3.4.2-150200.11.76.1
Wolfi5 products
- ffmpeg-7All versions (No fix recorded)
- ffmpeg-7.1< 7.1.5-r0
- ffmpeg-7.1-libavdevice61< 7.1.5-r2
- ffmpeg-7.1-libswscale8< 7.1.5-r2
- ffmpeg-8.0< 8.0.3-r0
Mageia2 products
- ffmpeg< 7.1.5-1.mga10 | < 7.1.5-1.mga10.tainted
- ffmpeg< 5.1.9-1.1.mga9 | < 5.1.9-1.1.mga9.tainted
Ubuntu2 products
- ffmpegAll versions (No fix recorded) | < 7:4.2.7-0ubuntu0.1+esm17 | < 7:4.4.2-0ubuntu0.22.04.1+esm16
- libavAll versions (No fix recorded)
Debian1 product
- ffmpegAll versions (No fix recorded) | < 7:7.1.5-0+deb13u1 | < 7:8.1.2-1
Ffmpeg1 product
- ffmpeg< 8.1.2
Opensuse1 product
- ffmpeg-7&distro=openSUSE Tumbleweed< 7.1.5-1.1
8 vendors · 41 products
